The right to object

  • You can exercise your right to object if the personal data processing involved is based on consent or on legitimate interest. When you object or withhold your consent, the PIC should no longer process the personal data, unless the processing is pursuant to a subppoena, for obvious purposes (contract, employer-employee relationship, etc.) or a result of a legal obligation.

  • In case there is any change or amendment to the information previously given to you, you should be notified and given an opportunity to withhold consent.

Example

The right to object is most specifically applicable when organizations or personal information controllers are processing your data without your consent for the following purposes:


  • Direct marketing purposes. When business organizations give you sales materials about products and services, they must explicitly inform or remind you of your right to object. If you feel uncomfortable to being target of a direct marketing campaign, you must be able to easily invoke your right to object. If you previously acceded but wishes to opt-out, you must be given an easy way to opt-out. In asserting your right to object being included in a direct marketing campaign, businesses have no recourse but to accede as there are no exemptions or grounds for refusal in this case.

  • Profiling purposes. Businesses customarily resort to profiling, or the creation of profiles of individual customers and clients without their consent. This is done either for marketing or customer care purposes. The cross-referencing of customer information to product marketing brings about practical advantages to both the buyer and seller in any potential business transaction. Under RA 10173, however, profiling of this requires your consent as customer, or else you are justified in invoking your right to object. The right of state agents to do profiling for law enforcement purposes, however, may override your right to object.

  • Automated processing purposes. In technology-driven industries, such as banking and finance, many decisions affecting individuals are arrived at electronically via automatic data processing systems based on personal information stored in computerized data files. This reduces the business transaction process down to a few seconds and facilitates a speedy exchange of economic value. Potentially, however, it may also inadvertently arrive at decisions prejudicial to your interests and lead to the weakening of your position as a transacting party. As such, organizations are required to notify you whether your personal data will undergo automatic processing, and inform you that you have a right to object.

How to exercise your right to object

Whenever you have the chance, you may assert your right to object verbally, be it in person or via a phone call. To have it formally documented, however, you must execute a written request to the organization, addressed to its Data Protection Officer (DPO), and have it received. In the letter, mention that your request is being made in exercise of your right to object under the Data Privacy Act of 2012. The DPO must act on your written request. In case you feel your request have not been addressed satisfactorily, you may file a formal complaint before the NPC, attached therewith your request letter to the DPO.